CVE-2024-26615

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix illegal rmb_desc access in SMC-D connection dump

A crash was found when dumping SMC-D connections. It can be reproduced

by following steps:

- run nginx/wrk test:

smc_run nginx

smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL>

- continuously dump SMC-D connections in parallel:

watch -n 1 'smcss -D'

BUG: kernel NULL pointer dereference, address: 0000000000000030

CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55

RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag]

Call Trace:

<TASK>

? __die+0x24/0x70

? page_fault_oops+0x66/0x150

? exc_page_fault+0x69/0x140

? asm_exc_page_fault+0x26/0x30

? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag]

? __kmalloc_node_track_caller+0x35d/0x430

? __alloc_skb+0x77/0x170

smc_diag_dump_proto+0xd0/0xf0 [smc_diag]

smc_diag_dump+0x26/0x60 [smc_diag]

netlink_dump+0x19f/0x320

__netlink_dump_star

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References